CVE-2008-5362: Adobe Air

Medium severity, CVSS 4.3. EPSS: 3.8% chance of exploitation in the next 30 days.

The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

Affected products

• Adobe Air: before 1.5 (fixed in 1.5)
• Adobe Flash Player: from 9.0.16.0, before 9.0.151.0 (fixed in 9.0.151.0); from 10, before 10.0.12.36 (fixed in 10.0.12.36)

Published 2008-12-08. Last modified 2026-06-16.